Privacy Policy

1. About This Policy and Who We Are

This Privacy Policy describes how Healthcentive Private Limited, a company incorporated under the Companies Act, 2013 (the "Company", "we", "our", "us"), collects, uses, stores, processes, and protects personal data of users of the mobile application branded as "Flow 108" (the "App" or the "Platform").

This Policy applies to all Users of the Platform. Please read this Policy carefully before using the Platform. This Privacy Policy must be read together with our Terms of Use and Community Guidelines, which govern your use of the Platform.

By registering on or using the Platform, you confirm that you have read, understood, and agree to the practices described in this Privacy Policy.

This Policy is prepared in accordance with the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and other applicable Indian laws and regulations.

2. Definitions

Term	Meaning
Data Fiduciary	Any person who alone or in conjunction with others determines the purpose and means of processing personal data. The Company is the Data Fiduciary in respect of data processed on the Platform.
Data Principal	The natural person to whom personal data relates. In the context of this Policy, the Data Principal is the User.
Data Processor	Any person who processes personal data on behalf of a Data Fiduciary. This includes third-party service providers engaged by the Company.
Personal Data	Any data about an individual who is identifiable by or in relation to such data.
SPDI	Sensitive Personal Data or Information as defined under the SPDI Rules, which includes health and medical data, biometric data, and financial information, among others.
Processing	Any operation or set of operations performed on personal data, including collection, recording, storage, use, sharing, disclosure, and deletion.
Consent	A free, specific, informed, unconditional, and unambiguous indication of the Data Principal's agreement to the processing of personal data, given by a clear affirmative action.
User	Any individual who registers on or uses the Platform, including visitors who access the Platform without registering.
Grievance Officer	The designated officer of the Company responsible for addressing grievances of Data Principals in relation to the processing of personal data. Details are set out in Section 17 of this Policy.

3. What Personal Data We Collect

3.1 Data You Provide at Registration

When you create an account on the Platform, we collect the following information:

• Display name
• Email address
• Phone number
• Google ID / Authentication token (where Google OAuth is used)
• Age
• Height
• Weight
• Activity level
• Last menstrual period date
• Menstrual cycle regularity
• Symptoms
• Health goal
• Body Mass Index (BMI)

3.2 Data You Log Continuously

As you use the Platform, you may voluntarily log the following data:

• Period dates and flow density
• Daily symptoms
• Weight entries
• Diet logs
• Workout completions
• Diet breach entries
• Fertility window and ovulation predictions
• Community forum posts

3.3 Data Collected Automatically

We also collect certain data automatically when you use the Platform:

• Device information (device type, operating system, device identifiers)
• IP address
• App usage data (features accessed, session duration, interaction patterns)
• Authentication tokens
• Firebase authentication data and push notification tokens

This data is collected for authentication, platform compatibility, security, internal analytics, product improvement, delivering in-app notifications and marketing messages where consented.

3.4 User-Uploaded Content

If you participate in the community forum, you may upload images or other content. Any images or content you post on the forum are processed and stored by us in accordance with this Policy and our Community Guidelines. Please exercise caution and avoid uploading images that contain identifiable personal or clinical information you do not wish to share with other registered members of the community.

3.5 Limited Platform Functionality

Certain features of the Platform require specific data to function. If you choose not to provide certain data, or if you withdraw consent for the processing of such data, some features of the Platform may not be available to you or may not function as intended.

4. Sensitive Personal Data Collection

The following categories of information we collect constitute Sensitive Personal Data or Information (SPDI) under applicable Indian law:

• Menstrual cycle data
• Fertility window data
• Symptoms and health conditions
• Health goals
• Body Mass Index (BMI)
• Daily health and diet logs
• Forum posts relating to health and personal experiences

Such data is collected only with your explicit consent and is used solely for the purposes described in this Policy.

5. Purposes for Processing Personal Data

We process your personal data for the following purposes:

1. Account creation and authentication — to register you as a user, verify your identity, and maintain your account.
2. Providing Platform services — to deliver cycle tracking, fertility predictions, diet plans, workout recommendations, calorie tracking, and other features of the Platform.
3. Personalisation — to tailor your experience on the Platform based on your health data, goals, and usage patterns.
4. Community forum — to enable your participation in the peer community forum and live sessions.
5. Communications — to send you service-related notifications, updates, reminders, and, where you have consented, marketing communications.
6. Analytics and product improvement — to understand how Users interact with the Platform and to improve its features, performance, and content.
7. Legal and regulatory compliance — to comply with applicable laws, regulations, court orders, and to enforce our Terms of Use and this Privacy Policy.

5.1 Google API Services User Data Policy Compliance

Where the Platform uses Google API Services to access or process user data, our use of such data complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide or improve user-facing features that are prominent in the Platform's user interface.
• We do not use Google user data for serving advertisements.
• We do not allow humans to read Google user data unless you have given explicit permission, it is necessary for security purposes, it is necessary to comply with applicable law, or our use is limited to internal operations and the data has been aggregated and anonymised.
• We do not transfer Google user data to third parties except as necessary to provide or improve the Platform's features, as required by law, or in connection with a merger or acquisition in compliance with applicable data protection obligations.

6. Consent — How We Obtain, Use, and Honour It

How Consent Is Obtained

We obtain your consent to process personal data, including SPDI, in the following ways:

• At registration — by presenting this Privacy Policy and our Terms of Use and requiring you to affirmatively agree before completing registration.
• In-app prompts — for specific data categories or features that require separate consent, we present clear consent prompts within the app.
• For marketing communications — we obtain your separate consent before sending promotional messages.

Consent is free, specific, informed, unconditional, and provided by a clear affirmative action. We do not use pre-ticked boxes or implied consent for the processing of SPDI.

How to Withdraw Consent

You may withdraw your consent to the processing of your personal data at any time by:

• Accessing the privacy settings within the Platform;
• Deleting your account through the account settings; or
• Writing to us at grievance@flow108.in.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Where you withdraw consent for processing that is necessary for the operation of the Platform, certain features may no longer be available to you.

7. Data Sharing and Third-Party Processors

7.1 Categories of Third-Party Processors

We engage third-party service providers to assist us in operating the Platform. These providers act as Data Processors and process personal data only on our instructions and for the purposes set out in this Policy. Categories of such providers include:

• Cloud infrastructure and hosting providers
• Authentication service providers (including Google Firebase)
• Analytics providers
• Payment processing providers
• Communication and notification service providers

7.2 Third-Party Platforms

Certain features of the Platform, such as live sessions, may be hosted on or integrated with third-party platforms (such as video conferencing services). Your use of such features may involve the processing of your data by those platforms, which is governed by their respective privacy policies. We encourage you to review the privacy policies of any third-party platforms before using them.

7.3 Limited Circumstances for Sharing

We do not sell, rent, or trade your personal data to third parties for their independent marketing or commercial purposes. We may share your personal data in the following limited circumstances:

• With your explicit consent;
• With our Data Processors as described in Section 7.1;
• To comply with applicable law, regulation, legal process, or a valid governmental request;
• To protect the rights, property, or safety of the Company, our Users, or others; or
• In connection with a merger, acquisition, or sale of all or a portion of our assets, subject to the acquirer agreeing to data protection obligations at least as protective as those set out in this Policy.

7.4 Changes to Service Providers

We may change our third-party service providers from time to time. In such cases, we will ensure that the new providers are bound by appropriate data processing agreements and provide at least the same level of data protection as described in this Policy.

8. Algorithmic Processing and AI-Based Recommendations

The Platform uses algorithmic processing to generate the following outputs based on data you provide:

• Menstrual cycle predictions
• Fertility window and ovulation predictions
• Personalised diet and workout recommendations
• Calorie tracking and nutritional insights
• Progress tracking and health insights

Important Disclaimer: All algorithmic outputs, predictions, and recommendations generated by the Platform are based on data you provide and general wellness principles. They are not medical advice, clinical diagnoses, or substitutes for professional healthcare. The accuracy of predictions depends on the completeness and accuracy of the data you log. Predictions may be less accurate for Users with irregular cycles or certain health conditions. You should always consult a qualified healthcare professional before making decisions about your health, fertility, or medical treatment.

9. Community Forum — User-Generated Content

The Platform includes a moderated community forum where registered Users may post content, share experiences, and interact with other members. Content you post on the forum is visible to all registered members of the community. Please do not post content that includes personally identifiable information about yourself or others that you do not wish to be visible to the broader community.

Upon deletion of your account, your forum posts will be retained but will be anonymised and attributed to "Deleted User". If you wish to have specific posts removed, please contact us at grievance@flow108.in before deleting your account.

10. Live Sessions

The Platform may offer live sessions and workshops hosted by expert contributors. Where a live session is recorded, you will be notified before the session begins and given the opportunity to consent to recording. Recorded sessions may be made available to subscribers on the Platform. Your participation in a live session constitutes your consent to appear in any recording of that session, unless you have been informed otherwise.

11. Data Storage, Retention, and Deletion

Where Data Is Stored

Your personal data is stored on servers located in India. We do not currently transfer personal data outside India. In the event of any future international transfer, we will comply with applicable law and ensure appropriate safeguards are in place.

How Long Data Is Retained

• Account data and health logs — retained for the duration of your account and for 30 days after account deletion, after which they are permanently deleted or irreversibly anonymised.
• Detailed activity logs — retained for up to 90 days following account deletion for security and fraud prevention purposes.
• Payment records — retained for 7 years as required under applicable Indian law.

Forum Posts After Account Deletion

As described in Section 9, forum posts are retained after account deletion but are anonymised. If you wish specific posts to be deleted, please make that request before deleting your account.

12. Data Security

Technical Measures

We implement the following technical security measures to protect your personal data:

• Encryption — personal data is encrypted in transit using industry-standard TLS/SSL protocols and at rest using appropriate encryption standards.
• Access controls — access to personal data is restricted to authorised personnel on a need-to-know basis.
• Authentication — secure authentication mechanisms, including Google OAuth, are used to verify user identity.
• Cloud infrastructure — the Platform is hosted on reputable cloud infrastructure providers that maintain their own security certifications and standards.
• Security audits — we conduct periodic security reviews and assessments of the Platform.

Organisational Measures

We implement organisational measures including staff training on data protection, data processing agreements with third-party processors, and internal data handling policies.

Security Breach and Incident Response

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant authorities as required under applicable law. We will take prompt remedial action to contain and address the breach.

13. User Rights

Under applicable Indian law, including the DPDPA and SPDI Rules, you have the following rights in relation to your personal data:

1. Right to Consent — the right to give, refuse, or withdraw consent to the processing of your personal data.
2. Right to Access — the right to obtain confirmation of whether your personal data is being processed and to receive a summary of the personal data held about you.
3. Right to Correction — the right to have inaccurate or incomplete personal data corrected.
4. Right to Deletion (Erasure) — the right to have your personal data erased in certain circumstances, including upon withdrawal of consent.
5. Right to Withdrawal — the right to withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal.
6. Right to Nominate — the right to nominate another individual to exercise your rights under the DPDPA in the event of your death or incapacity.
7. Right to Seek Redressal — the right to lodge a grievance with our Grievance Officer and, thereafter, with the Data Protection Board of India if the grievance is not resolved to your satisfaction.

To exercise any of these rights, please contact our Grievance Officer at grievance@flow108.in.

14. Users Outside India

The Platform is designed for users in India and is operated in compliance with Indian law. If you are accessing the Platform from outside India, please be aware that your personal data will be transferred to and processed in India. By using the Platform, you consent to such transfer and processing. We make no representation that the Platform or its content is appropriate for use in locations outside India.

15. Children's Privacy

The Platform is intended for women aged 18 years and above. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that a registered user is under 18 years of age, we will take prompt steps to delete that user's account and associated personal data. If you believe that a minor has provided personal data to us, please contact us at grievance@flow108.in.

16. Modifications to Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 15 days' advance notice by posting the updated Policy on the Platform and, where appropriate, by sending you a notification via the Platform or by email. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy. If you do not agree to the changes, you should stop using the Platform and may delete your account.